Terraform in, runners out
BYOC on AWS
Deploy runnerhut runners into your AWS account with Terraform: IAM, VPC, S3 cache and ECR pull-through.
Terraform module
A reviewed module rather than a click-through wizard.
IMDSv2 enforced
Instance metadata is v2-only by default.
S3 + ECR
Cache in your bucket, images through your pull-through cache.
Cost allocation tags
Runner spend lands in the tags your finance team already reports on.
The AWS deployment is the most mature BYOC target. Graviton instances make arm64 CI meaningfully cheaper, and local NVMe instance families give the disk performance the hosted product relies on.
hcl
module "runnerhut" { source = "runnerhut/runners/aws" version = "~> 1.0" vpc_id = aws_vpc.main.id subnet_ids = aws_subnet.private[*].id instance_types = ["c7g.4xlarge", "c7i.4xlarge"] max_capacity = 200}Common questions
- What IAM permissions does it need?
- Permissions to manage its own autoscaling group, cache bucket and instance role — scoped by tag or ARN prefix. Any vendor asking for wildcard administrative access or unrestricted PassRole should be questioned.
- How do I keep NAT costs down?
- Add an S3 gateway VPC endpoint, which is free and removes all cache traffic from NAT, then an ECR interface endpoint for image pulls. NAT is frequently the largest BYOC line item.
- Is IMDSv2 enforced?
- Yes, by default, with a metadata hop limit of 1. IMDSv1 is reachable from a compromised build step with a single unauthenticated request.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.